Privacy Policy
Last updated: 2026-08-23
This policy explains what Shotsmith does with personal data, why, and what you can do about it. It is written to be read rather than to be survived.
Who is responsible
The controller of your personal data is [name], trading as Shotsmith, of Greece (ΓΕΜΗ [company number], VAT [vat]).
For anything in this policy, write to privacy@shotsmith.co.
What we collect, and why
When you create an account
| Data | Why | Lawful basis |
|---|---|---|
| Name and email | To identify your account and contact you about it | Contract |
| Password (hashed) | To let you sign in | Contract |
| Language | To show the interface in it | Contract |
| Country, and VAT number if given | To calculate VAT correctly | Legal obligation |
| IP address at sign-up | To detect abuse of the free trial | Legitimate interests |
We store passwords hashed. We cannot read yours.
When you upload a photograph
Your photographs are personal data if a person can be identified in them, which is why the terms ask you not to upload those. Either way we treat them as yours.
We store the file, its dimensions and format, and which item and project it belongs to. We keep it while your account is open, so you can generate from it again, and delete it when you delete the item or the account.
When you generate an image
We record the prompt that was composed, which scene was used, which provider answered, how long it took, what it cost us, and how many credits it consumed.
We keep this because it is the record behind your credit balance. If you query a charge, this is what we look at.
When you pay
Payments are handled by Stripe. We never see your card number. Stripe gives us a customer reference, the card type and last four digits, and whether a payment succeeded. We keep invoices for as long as tax law requires.
When you use the free trial
A trial does not need an account, so we identify a session by a token in your browser and record the IP address it came from, to stop the same person taking the trial repeatedly. Trial data is deleted after 30 days.
When you simply visit the site
We do not run analytics. There is no tracking pixel, no advertising tag and no third-party script on the marketing site. Our servers keep ordinary access logs containing IP addresses for security and diagnosis, and those are deleted on a short rolling window.
See the cookie policy for the cookies this involves — there are three, and all of them are strictly necessary.
What we do not do
- We do not sell personal data. There is no arrangement under which we could.
- We do not use your photographs or your generated images to train models, ours or anyone else's.
- We do not share your images with other customers unless you publish them yourself through a share link or the showcase.
- We do not advertise to you based on what you upload.
- We make no automated decision that produces a legal or similarly significant effect on you.
Who else processes your data
We use these processors. Each is bound by a data processing agreement and may use your data only on our instructions.
| Processor | What for | Where |
|---|---|---|
| Stripe | Payments, invoicing, VAT | Ireland and the United States |
| Cloudflare R2 | Storing photographs and generated images | European Union |
| xAI | Generating images and video from your photograph | United States |
| fal.ai | Background removal, upscaling, fallback generation | United States |
Our servers and database are hosted in the European Union.
Transfers outside the EU
xAI and fal.ai process in the United States, and Stripe processes in both the EU and the US. Those transfers rely on the European Commission's Standard Contractual Clauses, and where applicable the EU–US Data Privacy Framework.
What this means in practice: when you generate an image, the photograph and the prompt are sent to a model provider outside the EU, processed, and the result returned. If that is not acceptable for a particular photograph, do not upload it.
How long we keep things
| Data | Kept for |
|---|---|
| Account details | Until you delete the account |
| Photographs and generated images | Until you delete them, or the account |
| Credit ledger | Until you delete the account, then anonymised |
| Invoices and tax records | As long as tax law requires, typically 5–10 years |
| Trial sessions | 30 days |
| Access logs | A short rolling window |
When you delete your account we erase your personal data and your files. We keep the credit ledger in anonymised form, because it is the accounting record behind payments already made, and we keep invoices because we are legally required to.
Your rights
Under the GDPR you can:
- Get a copy of your data, in a portable format.
- Correct anything inaccurate.
- Delete your data.
- Restrict or object to processing based on legitimate interests.
- Withdraw consent where consent is what we relied on, without affecting what was lawful before.
- Complain to a supervisory authority.
Two of these are buttons rather than emails. In your settings you can request an export, and you can request erasure. See the data rights page for what each actually does.
For anything else, write to privacy@shotsmith.co. We answer within one month, and will tell you if we need longer.
You can complain to the Hellenic Data Protection Authority (https://www.dpa.gr), or to the authority where you live.
Security
Traffic is encrypted in transit. Passwords are hashed. Source photographs are stored privately and served through signed, expiring links. Generated images are stored publicly, because share pages and social previews need to fetch them without a signature — treat a generated image as public once created.
Access to production data is limited to people who need it, and administrative actions on customer records are logged with the administrator who made them.
Children
Shotsmith is not for under-18s. We do not knowingly collect their data. If you believe we have, write to privacy@shotsmith.co and we will delete it.
Changes
We will post any change here and update the date at the top. For a material change we will email you before it takes effect.
Contact
privacy@shotsmith.co, or [name], Greece.